Scoping Tool Permissions for an AI Agent: The Pattern We Actually Use

The fastest way to build an agent is to give it broad access to everything and let the prompt tell it what not to do. The fastest way to have a bad incident is the exact same decision.

🎯 Scope Access to the Specific Task

An agent that only ever needs to read product data and write to a specific spreadsheet shouldn't have write access to the full database, even if it's "never going to use it that way" — prompts are guidance, not a security boundary.

🔐 Separate Read Access From Write Access Explicitly

Most agent tasks need far more read access than write access. Granting broad read but narrow, explicit write permissions limits the blast radius of a mistake to the specific things the agent is actually supposed to change.

🚦 Irreversible Actions Get a Human Gate

Anything that can't be easily undone — sending an email, charging a card, deleting data — goes through a human confirmation step regardless of how confident the agent is. This is the one rule we don't make exceptions to.

---

Originally published on the KLYX blog.